Business backup and ransomware: the 3-2-1 rule

01The five ways a business loses its data

Most people think of backup as protection against hardware failure: the disk that breaks, the computer that will not turn on again. It is the easiest case to picture, but it is not the only one, nor the most insidious. A business's data, meaning customer records, invoices, bookings, projects, years of archives, gets lost in five different ways, and each one asks something different of the backup copy.

Picture an ordinary Monday morning. You turn on the office computer and the files have strange names, none of them opens, and there is a message on the desktop demanding a payment. Or, more mundanely, your accountant asks for the March expenses spreadsheet and you discover that someone overwrote it in June. At that moment only one question matters: where do I restart from? This chapter is here so you have the answer ready before that Monday comes.

• Hardware failure. Disks, power supplies and boards break, even new ones. A solid-state drive gives no warning: one day it works, the next it is no longer recognized.
• Human error. The file overwritten with the wrong version, the folder dragged to the wrong place, the spreadsheet deleted to free up space. It is the most frequent cause in everyday life, and often nobody notices for weeks.
• Theft or loss. The laptop left in the car, the phone forgotten at the café. If the data lives only there, it leaves with the device.
• Ransomware. Malicious software encrypts the files and demands a ransom to give them back; more and more often it also copies them elsewhere and threatens to publish them. We look at it in detail further on.
• Local disaster. A fire, a flood, lightning striking the electrical system. Everything in the same building disappears together, backups included.

Three things that look like a backup and are not

Before talking about how to back up, it is worth clearing away three very common misconceptions, because they give a sense of security that is not real.

02The 3-2-1 rule, and its modern version

The most widely used rule for organizing backups is remembered by three numbers, and it has become a de facto standard because it answers, one by one, the threats we have just seen.

• 3 copies of the data: the original you work on plus two backup copies. Two copies, because even a copy can turn out to be damaged exactly when you need it.
• 2 different types of media: for example the server's disk and a NAS, or an external drive and cloud storage. A defect or an event that hits one type of media is unlikely to hit the other as well.
• 1 off-site copy: away from the office, so a fire, a flood or a theft does not take everything at once.

In recent years, as ransomware that hunts for backups has spread, the rule has grown into 3-2-1-1-0:

• +1 offline or immutable copy: a copy that is not connected to the network, or that the system storing it does not allow anyone to modify or delete until a set date. An attack that gets into the office computers cannot reach it.
• 0 errors: backups are verified and the restore is tested. A backup that has never been restored is a hope, not a guarantee.

03Full, incremental, differential: how much to copy each time

Copying everything every night is the simplest approach, but as the archive grows it becomes slow and takes up a lot of space. That is why there are three ways of making the copy, and they are almost always combined.

• Full: copies all the data, every time. Restoring is the simplest, because a single copy is enough; the price is time and space.
• Incremental: after a full backup, it copies only what has changed since the last backup of any type. It is the fastest and the lightest; to restore, though, you need the full backup and every incremental after it, in order.
• Differential: after a full backup, it copies everything that has changed since the last full one. It grows a little each day, but restoring takes just two pieces: the full backup and the latest differential.

How many versions to keep

Having yesterday's copy is not enough. Human error is often discovered weeks later, and ransomware can stay hidden for days before it activates: in both cases yesterday's copy already contains the problem. That is why you keep several staggered versions, a scheme the industry calls "grandfather, father, son":

• daily copies for the last seven or fourteen days;
• weekly copies for the last four or five weeks;
• monthly copies for the last twelve months, and for some archives one copy a year.

How long to keep them depends on the type of data and, for personal or accounting data, also on how long the law requires you to keep them or to delete them: a backup contains the same personal data as the original, with the same obligations. I cover this in the chapter on GDPR and cookies for a small business website.

04RPO and RTO: the two numbers that shape your backup

"How often should I back up?" has no one-size-fits-all answer. The right answer comes from two questions every business should ask itself calmly, before anything happens.

• RPO (Recovery Point Objective): how much data can I afford to lose? If the backup runs at night and the failure hits at six in the evening, a whole day's work is lost. If a day of lost bookings or orders is unacceptable, the backup has to be more frequent.
• RTO (Recovery Time Objective): how long can I afford to be down? Rebuilding a computer from scratch can take a day; a booking portal that stays offline for a day loses customers and reputation. The shorter the RTO, the more the restore has to be prepared and automated.

These are examples to help you get your bearings, not rules: the right numbers are set by whoever knows the business, weighing what an hour of downtime costs against what the solution that prevents it costs. Once written down, RPO and RTO become the specification for the backup: frequency, media, tools and restore tests are chosen to meet them.

05How ransomware works, and why it hunts for backups

Ransomware is malicious software that makes files unusable by encrypting them, that is, turning them into data that cannot be read without a key held only by whoever launched the attack, and then demands a ransom to hand that key over. In recent attacks, encryption is almost always paired with data theft and the threat to publish it: the so-called double extortion.

Knowing the stages of an attack helps you see where the backup makes the difference.

1. Getting in. In the vast majority of cases the attack comes through a very ordinary door: a phishing email with an attachment or a link, a stolen or reused password, remote access left open on the Internet, software that was never updated. The entry points and how to close them are the subject of the chapter on passwords, two-factor authentication and passkeys.
2. Spreading. Once inside one computer, the attack tries to reach the others on the same network, and above all the accounts with the most privileges, such as administrator accounts.
3. Hunting for backups. This is the step that makes ransomware different from a hardware failure. The joint guide from the US agencies CISA, FBI and NSA says so explicitly: many ransomware variants look for accessible backups in order to delete or encrypt them. An external drive that is always plugged in, or a network folder where the copies are stored, is found within minutes.
4. Encryption and theft. The files become unreadable, and a copy is often taken out before they are encrypted.
5. The demand. A message explains how to pay. Paying does not guarantee you get the data back, nor that it will not be published anyway, and it funds the next attack.

What actually saves you

The authorities' recommendation is always the same: keep offline, encrypted copies of important data, and test regularly that they can be restored. Offline means a copy that, at the moment of the attack, is not connected and cannot be reached: a drive that is plugged in only for the duration of the backup and then unplugged and taken away, or immutable storage, where the system itself prevents the copies from being modified or deleted before a set date, even by someone who has the password. The same guide advises using immutability with judgment, checking that retention complies with legal obligations on data.

06Where to keep the copies: storage media compared

There is no perfect medium: there is the right combination to meet the 3-2-1 rule with your own RPO and RTO. Here are the most common options for a small or medium-sized business, with their strengths and their limits.

Backing up servers and portals

For a website or a portal running on a server, the same rules apply, with a few extra precautions. Many providers offer snapshots of the machine: they are handy for rolling back after an update that went wrong, but they live with the same provider, sometimes in the same data center, and if the account is compromised they can be deleted. A real backup of a portal leaves both the machine and the provider. How to choose and manage the server, and the responsibilities that come with it, I explain in the chapter on VPS and shared hosting.

For databases there is a technical detail that makes the difference: copying the database files while it is running can produce an inconsistent copy. You use the database's own export tools, or its hot backup features, which guarantee a consistent snapshot even while the portal is taking orders.

Encrypting the copies, and where to keep the key

An off-site copy contains all of the business's data, including customers' personal data: it must be encrypted, so that whoever finds or steals it cannot read it. The key, however, must be kept in a safe place, separate from the computer being protected, and be known to at least two trusted people. An encrypted copy whose key has been lost is a lost copy.

Data in a format that can be read

There is one last aspect, often forgotten: the copy is only useful if the data can be read even without the program that created it, or if that program remains available. Management software that exports data in open formats, such as CSV files or a standard database, lets you start again even if you change provider. It is one of the points to check before signing, as I explain in the chapter on who really owns your website, the code and the data.

07The recovery plan: what to do on the worst day

Backup is half the job. The other half is knowing, in advance, what to do when you need it. On the worst day you do not improvise: you follow a sheet written with a cool head, with names, phone numbers and the steps in order.

1. Isolate. Disconnect the affected computers from the network, without switching them off if possible: switching off can erase traces that help you understand what happened. Immediately unplug any backup drives that are still attached.
2. Assess. Which computers, which data, since when. This is the moment when the versions kept over time show their value: you need to find the last copy that is certainly clean.
3. Report. Your trusted technician, first of all. If personal data is involved and the breach poses a risk to people, the data controller must notify the Garante per la protezione dei dati personali (the Italian data protection authority) within 72 hours of becoming aware of it, using the Garante's online procedure; if the risk is high, the people concerned must be informed as well. A cyber incident can also be reported to CSIRT Italia, the incident response team of the Agenzia per la Cybersicurezza Nazionale (Italy's national cybersecurity agency), and a crime must be reported to the police.
4. Clean up. Reinstall the affected systems from scratch, starting from clean, up-to-date installations. The authorities recommend keeping up-to-date "images" of critical systems ready precisely for this moment.
5. Restore. Bring the data back from the good copy, starting with what you need to get going again, according to the RTO decided beforehand.
6. Verify and change the keys. Check that the restored data is complete and opens, change every password that may have been exposed, and note down what worked and what did not, so you can improve the plan.

The restore test

All of this works only if it has been tested. Every so often, at least every few months and after every major change, you pick a random file, a folder, or the portal's entire database, and you actually restore it to a test location. You measure how long it takes and compare it with the RTO. It is the only way to discover, on a quiet day, that a copy was empty, that the encryption key can no longer be found, or that the restore takes twice as long as expected.

Backups protect data when something has already gone wrong. To make sure as little as possible goes wrong, defense starts at the front door: access, passwords and authentication factors, which are the subject of the next chapter. If you would like an opinion on your business's backup, here is how I work.

Frequently asked questions

Sources

1. CISA, FBI, NSA, MS-ISAC, "#StopRansomware Guide": offline and encrypted backups, restore tests, images of critical systems, immutable storage.
2. Garante per la protezione dei dati personali, "Violazioni di dati personali (data breach)" (in Italian): notification within 72 hours and the online procedure.
3. Regulation (EU) 2016/679 (GDPR): Articles 32, 33 and 34 on security, notification and communication of breaches.
4. Agenzia per la Cybersicurezza Nazionale, "CSIRT Italia" (in Italian): the incident response team and how to report cyber incidents.
5. ENISA, "Threat Landscape for Ransomware Attacks": how ransomware attacks work and double extortion.

Chapter updated October 2026. The RPO and RTO tables are examples to help you get your bearings, not prescriptions; for notification obligations in your specific case, the text of the Garante and of the European Regulation is authoritative.